From 73bea810299d9d4014b33feeba93135b103a7e27 Mon Sep 17 00:00:00 2001
From: Andrew <a@3ilson.com>
Date: Wed, 2 Oct 2019 22:30:48 -0400
Subject: [PATCH] Update 10-pf.conf
---
conf.d/10-pf.conf | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/conf.d/10-pf.conf b/conf.d/10-pf.conf
index 52f5c01..5734876 100644
--- a/conf.d/10-pf.conf
+++ b/conf.d/10-pf.conf
@@ -2,10 +2,8 @@
filter {
if "pf" in [tags] {
grok {
- #OPNSense
- match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
- #pfSense
- #match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
+ match => [ "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}",
+ "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" ]
add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "received_from", "%{host}" ]
}
--
GitLab